Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top


I´m planning to set up several virtualized centos, rhel or ubuntu guest machines on a single centos host server (most likely using KVM). Each guest VM is running an instance of a webapp + some other services/protocols, and each guest VM needs to be reachable from outside the host, on any open port, as if each of them was a separate, DNSed box.

I´m (apparently) weak in networking tech/config, so I am simply trying to find the first edges of this problem ie. the main approaches I need to look into to get a foothold on this. Networking config "pseudocode" if you will. :)


Let´s say I own the domain foo.com.

I have a physical CentOS machine DNSed as guests.foo.com.

On this physical host machine I've got three VMs running. I want the guest VMs to be reachable as 1.guests.foo.com, 2.guests.foo.com and 3.guests.foo.com. The guest VMs run centos, rhel and ubuntu distros.

Each VM needs to respond to any (locally open) port, not just http traffic, but also ssh connections and git: protocol operations.

Where do I start, what is the most elegant approach? What, roughly, does the host and guests each, minimally, need set up for this to work well?


I´ll update the question text + comments as I learn more.

share|improve this question
What HTTPD are you using? Apache? – Tim Aug 14 '12 at 19:09
On the guest VMs? Apache on all of them. – thomanil Aug 14 '12 at 19:10
I assume the Virtual "Host" (AKA Hypervisor) has 1 internet connection, thus having 1 public IP address, is that correct? – Tim Aug 14 '12 at 19:15
Correct, the host has 1 public ip address (DNSed as guests.foo.com in the example) – thomanil Aug 14 '12 at 19:18
Get more IP addresses or only use services supporting virtual hosts like httpd – Ulrich Dangel Aug 14 '12 at 19:20

The only way that you can have multiple systems serving the same port on one IP address is if the application protocol supplies extra information that helps the server identify which hostname the request was originally intended for. Without that, all the server can deduce at the TCP/IP layer is the destination IP address and port, which would be the same for all of your DNS names.

Most protocols don't support what you want. HTTP is an exception, because HTTP/1.1 includes the Host: header that tells the server which hostname the client was looking for. In HTTP, this is referred to as name-based virtual hosting. However, SSL breaks this again, and so there's an even newer extension called Server Name Indication that brings this support to the SSL as well. All systems can be expected to provide a Host: header these days, but SNI is still not fully supported everywhere.

The git protocol doesn't provide a hostname. However, git's new smart HTTP transport is a great way to run git over HTTP instead, which would allow you to do what you want.

Regardless of what you're using HTTP for, the actual way to set this up would be to run a proxying server on your primary IP address that uses name-based virtual hosting to direct the requests to the correct computer.

For SSH, there really aren't many options other than using different ports. You could make your own "bounce host" that works sort of like the proxying server, except manually: users first connect to your primary IP address, and it provides a mini shell that allows them to further ssh to the other hosts (using LAN IP addresses). You'll have a hard time making that work seamlessly with non-interactive protocols like SFTP or other automated connections, though. The other approach might be to make a SSH server that used information in the username to decide which host to connect to automatically: e.g. the command ssh username+machine1@example.com could connect to your single IP address, and then a modified SSH server there extracts the username and makes a new connection to username@machine1. I don't know of any existing software that would help you do this; it would likely need to be written.

Of course, if you use IPv6, you can give each machine a million public addresses of its own and you won't need any of these tricks.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.